CVE-2025-46355: PC Time Tracer Privilege Escalation Flaw

CVE-2025-46355 Overview

CVE-2025-46355 is an incorrect default permissions vulnerability in PC Time Tracer versions prior to 5.2. The flaw allows a local authenticated attacker to execute arbitrary code with SYSTEM privileges on Windows hosts running the affected product. The vulnerability is classified under CWE-276: Incorrect Default Permissions.

Exploitation requires local access and low privileges, but successful abuse results in full compromise of confidentiality, integrity, and availability on the target system. Keiyo System has published a fixed release addressing the issue.

Critical Impact
A low-privileged local user can escalate to SYSTEM on any Windows host running PC Time Tracer versions prior to 5.2, granting complete control of the machine.

Affected Products

PC Time Tracer versions prior to 5.2
Windows systems where PC Time Tracer is installed
Keiyo System PC Time Tracer product line

Discovery Timeline

2025-06-03 - CVE-2025-46355 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46355

Vulnerability Analysis

The vulnerability stems from incorrect default permissions applied during installation of PC Time Tracer. Files, directories, or services associated with the product are configured with overly permissive access control lists (ACLs) that allow standard users to modify components executed by a higher-privileged context.

Because the product runs with SYSTEM privileges on Windows, any attacker-controlled file loaded or executed by the privileged process inherits those privileges. This pattern is characteristic of [CWE-276] weaknesses in Windows applications that install services or scheduled tasks without hardening file and directory ACLs.

The issue is exploitable only by a local authenticated attacker. Network-based exploitation is not possible, and user interaction is required on the target host according to the CVSS 4.0 vector.

Root Cause

The root cause is the assignment of weak default permissions to installation artifacts belonging to PC Time Tracer prior to version 5.2. Standard users on the system inherit write access to executables, libraries, or configuration files that the privileged component subsequently loads. Refer to the JVN Security Advisory and the Keiyo System Article for vendor-supplied technical detail.

Attack Vector

A local authenticated attacker with standard user privileges replaces or modifies a writable file used by the PC Time Tracer privileged process. When the privileged process next loads the tampered file, the attacker's code executes as SYSTEM. No verified public exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

The vulnerability manifests through Windows ACL misconfiguration. See the referenced advisories for the specific components affected.

Detection Methods for CVE-2025-46355

Indicators of Compromise

Unexpected modification timestamps on files within the PC Time Tracer installation directory.
New or altered executables, DLLs, or configuration files in paths writable by standard users but executed by SYSTEM.
Child processes of PC Time Tracer components running under NT AUTHORITY\SYSTEM that spawn command shells or scripting hosts.

Detection Strategies

Audit ACLs on the PC Time Tracer installation directory using icacls and flag any entries granting Users, Authenticated Users, or Everyone write or modify permissions.
Monitor Windows Security event ID 4663 for write access to files within PC Time Tracer directories by non-administrative accounts.
Correlate process-creation events (event ID 4688 or Sysmon event ID 1) where a PC Time Tracer service loads a recently modified binary.

Monitoring Recommendations

Enable Sysmon with rules covering file creation and image loads within the product's install path.
Forward endpoint telemetry to a centralized platform capable of alerting on privilege escalation patterns tied to writable service binaries.
Baseline the expected file hashes of PC Time Tracer components and alert on drift.

How to Mitigate CVE-2025-46355

Immediate Actions Required

Upgrade PC Time Tracer to version 5.2 or later on every Windows host running the product.
Inventory all endpoints for legacy PC Time Tracer installations, including offline and infrequently used systems.
Restrict interactive logon on hosts running PC Time Tracer to trusted administrative users until patching is complete.

Patch Information

Keiyo System has released PC Time Tracer 5.2, which corrects the default permissions on installed components. Consult the Keiyo System Article and the JVN Security Advisory for download and upgrade guidance.

Workarounds

Manually harden ACLs on the PC Time Tracer installation directory to remove write and modify rights from non-administrative principals.
Remove PC Time Tracer from systems where it is not required until the patched version can be deployed.
Apply application allowlisting to prevent execution of unapproved binaries from within the product's install path.

bash

# Example: audit and restrict ACLs on the PC Time Tracer install directory
icacls "C:\Program Files\PC Time Tracer"
icacls "C:\Program Files\PC Time Tracer" /remove:g "Users"
icacls "C:\Program Files\PC Time Tracer" /remove:g "Authenticated Users"
icacls "C:\Program Files\PC Time Tracer" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"